CVE-2026-46294

Description

In the Linux kernel, the following vulnerability has been resolved: dm: fix a buffer overflow in ioctl processing Tony Asleson (using Claude) found a buffer overflow in dm-ioctl in the function retrieve_status: 1. The code in retrieve_status checks that the output string fits into the output buffer and writes the output string there 2. Then, the code aligns the "outptr" variable to the next 8-byte boundary: outptr = align_ptr(outptr); 3. The alignment doesn't check overflow, so outptr could point past the buffer end 4. The "for" loop is iterated again, it executes: remaining = len - (outptr - outbuf); 5. If "outptr" points past "outbuf + len", the arithmetics wraps around and the variable "remaining" contains unusually high number 6. With "remaining" being high, the code writes more data past the end of the buffer Luckily, this bug has no security implications because: 1. Only root can issue device mapper ioctls 2. The commonly used libraries that communicate with device mapper (libdevmapper and devicemapper-rs) use buffer size that is aligned to 8 bytes - thus, "outptr = align_ptr(outptr)" can't overshoot the input buffer and the bug can't happen accidentally

Description (MITRE) cveawg.mitre.org

Pulled from cveawg.mitre.org/api/cve/CVE-2026-46294 on 2026-07-26. Shown when MITRE's text differs from the cvelistV5 mirror.

In the Linux kernel, the following vulnerability has been resolved: dm: fix a buffer overflow in ioctl processing Tony Asleson (using Claude) found a buffer overflow in dm-ioctl in the function retrieve_status: 1. The code in retrieve_status checks that the output string fits into the output buffer and writes the output string there 2. Then, the code aligns the "outptr" variable to the next 8-byte boundary: outptr = align_ptr(outptr); 3. The alignment doesn't check overflow, so outptr could point past the buffer end 4. The "for" loop is iterated again, it executes: remaining = len - (outptr - outbuf); 5. If "outptr" points past "outbuf + len", the arithmetics wraps around and the variable "remaining" contains unusually high number 6. With "remaining" being high, the code writes more data past the end of the buffer Luckily, this bug has no security implications because: 1. Only root can issue device mapper ioctls 2. The commonly used libraries that communicate with device mapper (libdevmapper and devicemapper-rs) use buffer size that is aligned to 8 bytes - thus, "outptr = align_ptr(outptr)" can't overshoot the input buffer and the bug can't happen accidentally

Overview

State

—

Assigner (CNA)

—

CVSS severity

high

CVSS score

7.8 / 10

CVSS vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Effective score

7.8 / 10 HIGH source: CNA overview

CWE(s)

—

Reserved

—

Published

—

Last updated

—

Source

https://www.tenable.com/cve/CVE-2026-46294

Linked Threat

CVE-2026-46294 — CVE-2026-46294

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published

2026-06-08 17:16:47 UTC

NVD last modified

2026-07-23 08:10:00 UTC

NVD CVSS v3.1

7.8 / 10 HIGH source: nvd@nist.gov

NVD CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability subscore

1.8 / 10

Impact subscore

5.9 / 10

EPSS score

0.0014 (probability of exploitation in next 30 days)

EPSS percentile

3.98% vs all CVEs — higher = more likely to be exploited, as of 2026-07-26

NVD-assigned CWE(s): CWE-787 (differs from the CNA list above)

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID

EUVD-2026-35160

Assigner

Linux

Published

Jun 8, 2026, 3:46:21 PM

Updated

Jun 14, 2026, 6:07:06 PM

EUVD base score

0.0 / 10

EUVD-reported EPSS

0.1400

Vendors

Linux

Products

Linux (2.6.12)

Linux (patch: 6.18.30)

Linux (patch: 5.15.209)

Linux (1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <2fa49cc884f6496a915c35621ba4da35649bf159)

Linux (patch: 0)

Linux (patch: 6.6.140)

Linux (patch: 7.1)

Linux (patch: 6.12.88)

Linux (1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <526ff9126a0ae087b65726e1faf31114c718020d)

Linux (1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <8daa6c708ef524089ae43f2aed9190acb26d7df8)

Linux (1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <d271631023cbe1cbe7c31a0275ab797883be6e0a)

Linux (1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <448ee8fb79c26a26599ffa4b2adeb4322d3d3d8c)

Linux (1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <c8c5311237448f6ffeecc9aec2362e3692623668)

Linux (patch: 5.10.258)

Linux (patch: 7.0.7)

Linux (1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <f0b0b09d9840838ae77ccdd6a62de0daef4e6e0a)

Linux (1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <5af6a879e915ae7bcd83695c316ebb32e1c61bc2)

Linux (patch: 6.1.175)

Aliases

GHSA-c9hh-9962-q529

ENISA description: In the Linux kernel, the following vulnerability has been resolved: dm: fix a buffer overflow in ioctl processing Tony Asleson (using Claude) found a buffer overflow in dm-ioctl in the function retrieve_status: 1. The code in retrieve_status checks that the output string fits into the output buffer and writes the output string there 2. Then, the code aligns the "outptr" variable to the next 8-byte boundary: outptr = align_ptr(outptr); 3. The alignment doesn't check overflow, so outptr could point past the buffer end 4. The "for" loop is iterated again, it executes: remaining = len - (outptr - outbuf); 5. If "outptr" points past "outbuf + len", the arithmetics wraps around and the variable "remaining" contains unusually high number 6. With "remaining" being high, the code writes more data past the end of the buffer Luckily, this bug has no security implications because: 1. Only root can issue device mapper ioctls 2. The commonly used libraries that communicate with device mapper (libdevmapper and devicemapper-rs) use buffer size that is aligned to 8 bytes - thus, "outptr = align_ptr(outptr)" can't overshoot the input buffer and the bug can't happen accidentally

Vendor references (0)

References embedded in the original CVE record by the assigning CNA.

None in the CVE record.

Web references (10)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

• https://git.kernel.org/stable/c/2fa49cc884f6496a915c35621ba4da35649bf159 tenable:git.kernel.org
• https://git.kernel.org/stable/c/448ee8fb79c26a26599ffa4b2adeb4322d3d3d8c tenable:git.kernel.org
• https://git.kernel.org/stable/c/526ff9126a0ae087b65726e1faf31114c718020d tenable:git.kernel.org
• https://git.kernel.org/stable/c/5af6a879e915ae7bcd83695c316ebb32e1c61bc2 tenable:git.kernel.org
• https://git.kernel.org/stable/c/8daa6c708ef524089ae43f2aed9190acb26d7df8 tenable:git.kernel.org
• https://git.kernel.org/stable/c/c8c5311237448f6ffeecc9aec2362e3692623668 tenable:git.kernel.org
• https://git.kernel.org/stable/c/d271631023cbe1cbe7c31a0275ab797883be6e0a tenable:git.kernel.org
• https://git.kernel.org/stable/c/f0b0b09d9840838ae77ccdd6a62de0daef4e6e0a tenable:git.kernel.org
• https://nvd.nist.gov/vuln/detail/CVE-2026-46294 tenable:nvd.nist.gov
• https://www.cve.org/CVERecord?id=CVE-2026-46294 tenable:www.cve.org

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

• Nvd - Cve-2026-46940
  web:nvd.nist.gov

  An official website of the United States government Here's how you know

  2026-06-19 02:38 UTC
• Oracle CPU April 2026: Delayed RUs & First Analysis
  web:oradba.ch

  On April 21, 2026 , Oracle released the Critical Patch Update (CPU) for April 2026 — 481 new security fixes across the entire Oracle product stack. For Oracle Database, this means another round of mandatory patching. What makes this quarter unusual: several key Release Updates, including 19.31 and 23.26.2, were not available on release day and are delayed by up to a week or more.

  2026-06-19 02:38 UTC
• Security Update Guide - Loading - Microsoft
  web:portal.msrc.microsoft.com

  The Security Update Guide provides information on the latest Microsoft security updates, helping users understand and address potential vulnerabilities effectively.

  2026-06-19 02:38 UTC
• June 9, 2026—KB5094126 (OS Builds 26200.8655 and 26100.8655)
  web:support.microsoft.com

  This cumulative update for Windows 11, version 25H2 and 24H2 (KB5094126) includes the latest security fixes and improvements, along with non-security updates from last month's optional preview release. Visit the Windows release health dashboard for the latest status on this release.

  2026-06-19 02:38 UTC
• Landing Page | ServiceNow Common Vulnerabilities & Exposures (CVE ...
  web:support.servicenow.com

  Overview The advisories below document publicly disclosed Common Vulnerabilities and Exposures ( CVEs ) in the Now Platform by ServiceNow. Because ServiceNow uses various methods to communicate vulnerability information, patches, and other fixes, customers should review family, security patch , and hotfix release notes, which are available at https://docs.servicenow.com, for a complete list of ...

  2026-06-19 02:38 UTC
• Oracle Critical Patch Update Advisory - April 2026
  web:www.oracle.com

  Oracle Critical Patch Update Advisory - April 2026 Description A Critical Patch Update is a collection of patches for multiple security vulnerabilities. These patches address vulnerabilities in Oracle code and in third party components included in Oracle products. These patches are usually cumulative, but each advisory describes only the security patches added since the previous Critical Patch ...

  2026-06-19 02:38 UTC
• Oracle Critical Security Patch Update Advisory - May 2026
  web:www.oracle.com

  Prior Critical Patch Update and Critical Security Patch Update advisories should be reviewed for information regarding earlier published security patches. Refer to Critical Patch Updates, Critical Security Patch Updates, Security Alerts and Bulletins for information about Oracle Security advisories.

  2026-06-19 02:38 UTC
• Qualys Automated Patch Management Security software
  web:www.qualys.com

  Accelerate vulnerability remediation by 43% with practical recommendations and a strategic roadmap to bolster your security. Achieve a 90% patch rate improvement through smart automation and Qualys Patch Management.

  2026-06-19 02:38 UTC
• Oracle April 2026 Critical Patch Update 241 CVEs | Tenable®
  web:www.tenable.com

  Oracle addresses 241 CVEs in its April Critical Patch Update, the second quarterly update of 2026 with 481 patches, including 34 critical updates.

  2026-06-19 02:38 UTC
• Patch Tuesday June 2026: Security Updates & CVE Analysis
  web:zecurit.com

  Get the complete breakdown of Microsoft's June 2026 Patch Tuesday. We analyze the latest security updates and all critical CVEs .

  2026-06-19 02:38 UTC

Only Available for Registered Users. Sign in to view.